rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP …

A command injection vulnerability exists in rclone prior to v1.75.0 affecting the SFTP backend. The function quoteOrEscapeShellPath in backend/sftp/sftp.go only escapes ASCII apostrophes, but PowerShell also treats Unicode characters U+2018, U+2019, U+201A, and U+201B as single-quote delimiters. An attacker who can control a remote filename can craft a malicious filename using these Unicode quote characters to break out of the intended PowerShell path literal. This allows appending arbitrary PowerShell statements that execute in the context of the victim's SSH account when server-side hashing is triggered. The vulnerability requires the attacker to control filenames on the remote SFTP server. The issue has been patched in rclone v1.75.0. Users are advised to upgrade immediately to mitigate the risk of remote code execution.